Import mini-framework for paxctl(8) on NetBSD/{amd64,i386}

This allows setting flags for PaX on select binaries. Two new variables
are introduced for packages: NOT_PAX_ASLR_SAFE and NOT_PAX_MPROTECT_SAFE.
They both expect a list of binaries are known to not support PaX ASLR
and/or PaX MPROTECT, respectively.

"Please commit" wiz@

(khorben)